Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-3087 — Improper Input Validation in Apache Struts

CWE-20 — Improper Input Validation9 documents7 sources
Severity
9.8CRITICALNVD
EPSS
87.0%
top 0.56%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Struts
Timeline
PublishedJun 7
Latest updateMay 14

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDapache/struts5 versions+4

🔴Vulnerability Details

4
GHSA
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation↗2022-05-14
▶
OSV
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation↗2022-05-14
▶
OSV
openssl regression↗2016-09-23
▶
CVEList
CVE-2016-3087: Apache Struts 2↗2016-06-07
▶

💥Exploits & PoCs

2
Exploit-DB
Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution↗2017-06-06
▶
Exploit-DB
Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit)↗2016-06-10
▶

📋Vendor Advisories

1
Red Hat
struts: Passing malicious expression can cause RCE when Dynamic Method Invocation is enabled and REST plugin is used↗2016-05-31
▶

💬Community

1
Bugzilla
CVE-2016-3087 struts: Passing malicious expression can cause RCE when Dynamic Method Invocation is enabled and REST plugin is used↗2016-06-01
▶
CVE-2016-3087 — Improper Input Validation in Apache | cvebase